CVE-2026-2688: Unknown Hipaa Forms

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

Affected products

• Unknown Hipaa Forms: before 3.2.0 (fixed in 3.2.0)

Published 2026-09-02. Last modified 2026-09-03.